diff options
| author |   otto <otto@openbsd.org> | 2004-12-22 18:57:28 +0000 |
|---|---|---|
| committer | otto <otto@openbsd.org> | 2004-12-22 18:57:28 +0000 |
| commit | 0ee3f80e99caffcd10b7da2f397c575997bd5cce (patch) | |
| tree | 44cdb124ef171726129788f0eabd48b8d14677bc /bin/ksh/expr.c | |
| parent | Fix previous commit here, I add the case statement to the wrong switch. (diff) | |
| download | wireguard-openbsd-0ee3f80e99caffcd10b7da2f397c575997bd5cce.tar.xz wireguard-openbsd-0ee3f80e99caffcd10b7da2f397c575997bd5cce.zip | |
Fix a use-after-free, that causs core dumps if a shell is killed
running with strict malloc.conf options. Problem spotted by hshoexer@;
fix by me with some help from millert@.
ok millert@ hshoexer@ krw@ deraadt@
Diffstat (limited to 'bin/ksh/expr.c')
| -rw-r--r-- | bin/ksh/expr.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/bin/ksh/expr.c b/bin/ksh/expr.c index dc96d981974..34c8901cc83 100644 --- a/bin/ksh/expr.c +++ b/bin/ksh/expr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: expr.c,v 1.15 2004/12/22 17:14:34 millert Exp $ */ +/* $OpenBSD: expr.c,v 1.16 2004/12/22 18:57:28 otto Exp $ */ /* * Korn expression evaluation @@ -175,7 +175,7 @@ v_evaluate(struct tbl *vp, const char *expr, volatile int error_ok) /* Clear EXPRINEVAL in of any variables we were playing with */ if (curstate.evaling) curstate.evaling->flag &= ~EXPRINEVAL; - quitenv(); + quitenv(NULL); if (i == LAEXPR) { if (error_ok == KSH_RETURN_ERROR) return 0; @@ -203,7 +203,7 @@ v_evaluate(struct tbl *vp, const char *expr, volatile int error_ok) /* can fail if readonly */ setstr(vp, str_val(v), error_ok); - quitenv(); + quitenv(NULL); return 1; } |